Network security monitoring system based on AI

Abstract

The invention discloses a network security monitoring system based on AI. The network security monitoring system comprises a first subsystem and a second subsystem, the first subsystem is used for monitoring and analyzing network security; the second subsystem is used for monitoring and analyzing the security of network hardware equipment; the first subsystem comprises a network environment acquisition module, an anomaly detection module, a threat identification module, an automatic response module and a trend analysis and prediction module; the network environment acquisition module is used for acquiring network environment information, the anomaly detection module is used for analyzing the network environment information through an AI algorithm to obtain network state information, and the network state information comprises network normality and network anomaly; and the threat identification module is used for further analyzing abnormal reasons and determining whether potential network threats exist or not when the network state information is network abnormity. According to the invention, network security monitoring can be carried out more comprehensively and intelligently, and the network security can be ensured better.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to an AI-based network security monitoring system. Background Art

[0002] Network security monitoring refers to the real-time monitoring and detection of network systems and data to detect potential security threats or abnormal behaviors. Network security monitoring is a key link in maintaining network security. By establishing an effective monitoring and response system, network security threats can be discovered and responded to in a timely manner to protect the security of information systems and data.

[0003] In the process of monitoring network security, the network security monitoring system will be used.

[0004] The existing network security monitoring system has a low level of intelligent monitoring and cannot detect new network security risks in a timely manner, thus failing to ensure network security well, which has a certain impact on the use of the network security monitoring system. Therefore, an AI-based network security monitoring system is proposed. Summary of the invention

[0005] The technical problem to be solved by the present invention is: how to solve the problem that the existing network security monitoring system has a low level of monitoring intelligence and cannot timely discover new network security risks, thereby failing to ensure network security well, which has brought certain impacts on the use of the network security monitoring system. An AI-based network security monitoring system is provided.

[0006] The present invention solves the above technical problems through the following technical solutions. The present invention includes a first subsystem and a second subsystem;

[0007] The first subsystem is used to monitor and analyze network security itself;

[0008] The second subsystem is used to monitor and analyze the security of network hardware equipment;

[0009] The first subsystem network environment acquisition module, anomaly detection module, threat identification module, automated response module and trend analysis and prediction module;

[0010] The network environment collection module is used to collect network environment information, and the anomaly detection module is used to analyze the network environment information through an AI algorithm to analyze network status information, where the network status information includes network normality and network anomaly;

[0011] The threat identification module is used to further analyze the cause of the abnormality and determine whether there is a potential network threat when the network status information indicates that the network is abnormal;

[0012] The automated response module is used to perform an automated protection response to a corresponding threat when the threat identification module identifies a network threat;

[0013] The trend analysis and prediction module is used to collect historical data and current threat content of network security monitoring, and analyze historical data and current threats to predict possible threats in the future;

[0014] The second subsystem includes a hardware information collection, a protection level setting module, a protection measure implementation module and a data sending module;

[0015] Hardware information collection The collection module is used to obtain relevant information of network hardware devices;

[0016] The protection level setting module is used for users to set the hardware device protection level according to their needs;

[0017] The protection measure implementation module is used to select and implement protection measures according to the protection level of the hardware equipment, collect and analyze protection data after implementation, and obtain abnormal warning information;

[0018] The data sending module is used to send out the abnormal warning information after it is generated.

[0019] Furthermore, the network environment collection module collects network environment information including network traffic, user behavior, and system logs;

[0020] The anomaly detection module analyzes the network environment information through the AI ​​algorithm, and the specific process of analyzing the network status information is as follows:

[0021] Data preprocessing: preprocessing network environment information. The preprocessing includes cleaning data, removing noise, errors and duplicates, and standardizing or normalizing it to obtain preprocessed data.

[0022] Feature extraction: extracting the required features, the content of which is related to the abnormal behavior;

[0023] Characteristics may include traffic size, access pattern, request frequency, IP address, port number, URL, etc.

[0024] Use feature engineering to optimize these features to improve the performance of the model;

[0025] Model selection and training: select AI algorithms to train anomaly detection models. The selected AI algorithms include clustering algorithms, anomaly detection algorithms, and classification algorithms.

[0026] Use historical data to train the model. The historical data includes samples of normal and abnormal network environments.

[0027] The first model, the second model and the third model are trained respectively using a clustering algorithm, anomaly detection algorithm and classification algorithm;

[0028] Input the preprocessed real-time network environment information into the trained first model, second model and third model to obtain the first model result, second model result and third model result;

[0029] When the first model result, the second model result and the third model result are all network environment abnormalities, it is determined that the network environment is abnormal;

[0030] When two of the first model results, the second model results, and the third model results are normal and one is abnormal, the model training is performed again;

[0031] The data anomaly in the first model result, the second model result and the third model result is determined as follows: if the difference between the input data and the normal pattern in the model exceeds a preset range, the model will mark it as an anomaly.

[0032] Furthermore, the threat identification module further analyzes these network environment anomalies to determine whether there are potential network threats, uses big data analysis and machine learning technology to identify malicious behaviors in the network, and issues early warnings for possible threats.

[0033] Furthermore, the first subsystem also includes a security library establishment module, a visualization module and a penetration testing module;

[0034] The security library establishment module is used to collect network historical data and establish a security library based on the network historical data;

[0035] The visualization module is used to visualize the network security information and send it to a preset terminal for display;

[0036] The penetration test module is used to perform a simulated penetration test and send the penetration test results to a preset receiving terminal after obtaining them.

[0037] Furthermore, the specific process of the security library establishment module establishing the security library is as follows:

[0038] First, conduct a needs analysis to clarify the goals and uses of the security knowledge base and analyze the types of information that need to be included in the knowledge base;

[0039] Data collection: Collect data related to network security from network historical data;

[0040] Data cleaning and organization: Clean the collected data, remove duplicate, redundant or invalid information, and organize the data into a unified format and structure to facilitate subsequent processing and analysis;

[0041] Knowledge extraction and structuring: extract the required security knowledge from the cleaned data, structure the required security knowledge, and use knowledge graph technology to build a structured security knowledge base;

[0042] Knowledge verification and review: verify the extracted and structured security knowledge to verify its accuracy and completeness;

[0043] When there are no abnormalities in the verification accuracy and completeness, knowledge storage and management are carried out, and the verified security knowledge is stored in the knowledge base.

[0044] Furthermore, the specific process of the penetration test module for performing the simulated penetration test is as follows:

[0045] First, AI model training is performed using historical penetration test data, known security vulnerabilities, and hacker attack patterns in historical network security information to train the AI ​​model.

[0046] Automated attack simulation: AI models simulate hacker attack behaviors, conduct automated penetration tests on the network undergoing security monitoring, and obtain penetration test data;

[0047] Result analysis and reporting: Analyze the penetration test data, identify security vulnerabilities and potential problems in the system, and generate a test report to send to the preset receiving terminal.

[0048] Furthermore, the penetration test module performs a simulated penetration test under the following conditions: first, the number of real-time network access users is collected, and when the number of real-time network access users is less than a preset value, a simulated test is allowed;

[0049] Analyze and evaluate the simulated penetration test to assess whether the tools and methods used in the simulated penetration test will cause irreversible damage to the target system. If the tools and methods used will not cause irreversible damage to the target system, the simulated test will be allowed.

[0050] Furthermore, the specific process of the protection measure implementation module selecting and implementing protection measures according to the hardware device protection level is as follows: extracting the collected hardware device protection level, the hardware device protection level includes level one protection, level two protection and level three protection;

[0051] When the hardware equipment protection level is level one, the protection measures corresponding to level one are selected for implementation;

[0052] When the hardware equipment protection level is level 2, the protection measures corresponding to level 2 protection are selected for implementation;

[0053] When the hardware equipment protection level is level 3, the protection measures corresponding to level 3 protection are selected for implementation;

[0054] The protection measures corresponding to the first-level protection include a first-density hardware device monitoring device, a first-density temperature sensor, a first-density humidity sensor and a first hardware encryption measure;

[0055] The protection measures corresponding to the second-level protection include a second-density hardware device monitoring device, a second-density temperature sensor, a second-density humidity sensor and a second hardware encryption measure;

[0056] The protection measures corresponding to the third level of protection include third density hardware device monitoring equipment, third density temperature sensors, third density humidity sensors and third hardware encryption measures.

[0057] Furthermore, the magnitude relationship among the first density, the second density and the third density is: first density>second density>third density;

[0058] The difference between the first hardware encryption measure, the second hardware encryption measure and the third hardware encryption measure is that;

[0059] The first hardware encryption measure uses random three of DES, AES, RSA, and ECC for repeated encryption;

[0060] The second hardware encryption measure uses random two of DES, AES, RSA, and ECC for repeated encryption;

[0061] The third hardware encryption measure uses a random one of DES, AES, RSA, and ECC for repeated encryption.

[0062] Furthermore, the specific judgment process of obtaining abnormal warning information through protection data collection and analysis is as follows: extract the real-time protection data collected at the corresponding protection level, and then extract the standard protection data of the corresponding protection level from the preset database. When the deviation between the real-time protection data and the standard protection data is greater than the preset value, abnormal warning information is generated.

[0063] Compared with the prior art, the present invention has the following advantages: the network security monitoring system based on AI can monitor the network status in real time and quickly identify abnormal behavior or potential threats through AI technology. Once a threat is found, the AI ​​system can immediately trigger a response mechanism to reduce the time window for attackers to exploit vulnerabilities. Network security protection involves the analysis and processing of a large amount of data. AI technology can efficiently process this data, quickly discover potential threats and abnormal behaviors, and thus achieve intelligent decision-making. Through algorithms and models, false alarms can be reduced, and the accuracy of threat detection can be improved, thereby reducing the burden on the security team, achieving more accurate security monitoring, reducing false alarm rates and improving accuracy, and being able to identify more types of network abnormal states. At the same time, by performing hardware monitoring settings, different types of monitoring equipment assembly densities are set according to the actual security needs of users. Different network areas or applications may face different degrees of security threats. By adjusting the installation density of security protection equipment according to the security level, it can ensure that more security resources are deployed in high-risk areas, while appropriately reducing them in low-risk areas to avoid waste of resources, making the system more worthy of promotion and use. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0065] The following is a detailed description of an embodiment of the present invention. This embodiment is implemented on the premise of the technical solution of the present invention, and a detailed implementation method and a specific operation process are given, but the protection scope of the present invention is not limited to the following embodiment.

[0066] like Figure 1 As shown, this embodiment provides a technical solution: an AI-based network security monitoring system, comprising a first subsystem and a second subsystem;

[0067] The first subsystem is used to monitor and analyze network security itself;

[0068] The first subsystem includes a network environment acquisition module, anomaly detection module, threat identification module, automated response module, and trend analysis and prediction module;

[0069] The network environment collection module is used to collect network environment information. First, it collects various data from the network environment, including network traffic, user behavior, system logs, etc. These data are the basis for AI analysis and detection;

[0070] The anomaly detection module is used to analyze network environment information through AI algorithms to analyze network status information. Network status information includes network normality and network anomalies. The collected data is analyzed to identify abnormal patterns or behaviors. These anomalies may include unauthorized access, malware activities, data leakage, etc. AI can identify anomalies by learning normal behavior patterns, or detect abnormal traffic by analyzing network traffic. The network environment collection module collects network environment information including network traffic, user behavior, and system logs. The anomaly detection module analyzes network environment information through AI algorithms. The specific process of analyzing network status information is as follows:

[0071] Data preprocessing: preprocessing network environment information. The preprocessing includes cleaning data, removing noise, errors and duplicates, and standardizing or normalizing it to obtain preprocessed data.

[0072] Feature extraction: extracting the required features, the content of which is related to the abnormal behavior;

[0073] Characteristics may include traffic size, access pattern, request frequency, IP address, port number, URL, etc.

[0074] Use feature engineering to optimize these features to improve the performance of the model;

[0075] Model selection and training: select AI algorithms to train anomaly detection models. The selected AI algorithms include clustering algorithms, anomaly detection algorithms, and classification algorithms.

[0076] Use historical data to train the model. The historical data includes samples of normal and abnormal network environments.

[0077] The first model, the second model and the third model are trained respectively using a clustering algorithm, anomaly detection algorithm and classification algorithm;

[0078] Input the preprocessed real-time network environment information into the trained first model, second model and third model to obtain the first model result, second model result and third model result;

[0079] When the first model result, the second model result and the third model result are all network environment abnormalities, it is determined that the network environment is abnormal;

[0080] When two of the first model results, the second model results, and the third model results are normal and one is abnormal, the model training is performed again;

[0081] The data anomaly in the first model result, the second model result and the third model result is determined as follows: if the difference between the input data and the normal mode in the model exceeds the preset range, the model will mark it as abnormal;

[0082] At the same time, the model also needs to be processed and evaluated and updated. The performance of the evaluation model, including indicators such as false alarm rate and missed alarm rate, should be adjusted according to the evaluation results, or the model structure should be improved. The model should be retrained with new data to adapt it to new threat patterns and attack methods, and the anomaly detection process should be automated to monitor network activities in real time. The anomaly detection model should be integrated into the existing network security framework to achieve comprehensive security protection.

[0083] The threat identification module is used to further analyze the cause of the anomaly and determine whether there are potential network threats when the network status information is a network anomaly. Once AI detects an anomaly, it will further analyze these anomalies to determine whether there are potential network threats. AI can use big data analysis and machine learning technology to quickly identify malicious behavior in the network and issue early warnings for possible threats. By analyzing massive amounts of network data, AI can detect abnormal traffic, abnormal access, malicious code, etc., detect threats in a timely manner and take corresponding defensive measures. The threat identification module further analyzes these network environment anomalies to determine whether there are potential network threats, and uses big data analysis and machine learning technology to identify malicious behavior in the network and issue early warnings for possible threats.

[0084] The automated response module is used to automatically respond to threats when the threat identification module identifies a network threat. After identifying a threat, the AI ​​system can automatically trigger a series of response measures to mitigate or eliminate the impact of the threat. These response measures may include isolating infected systems, blocking malicious traffic, sending alarm notifications, etc.

[0085] The trend analysis and prediction module is used to collect historical data and current threat content of network security monitoring, and analyze historical data and current threats to predict possible future threats. It can also predict possible future threats by analyzing historical data and current threat patterns. This prediction capability can help network administrators take preventive measures in advance and optimize security strategies to deal with future threats;

[0086] The first subsystem also includes a security library building module, a visualization module and a penetration testing module;

[0087] The security library establishment module is used to collect network historical data and establish a security library based on the network historical data. The specific process of establishing the security library by the security library establishment module is as follows:

[0088] First, conduct a needs analysis to clarify the goals and uses of the security knowledge base and analyze the types of information that need to be included in the knowledge base;

[0089] Data collection: Collect data related to network security from network historical data;

[0090] Data cleaning and organization: Clean the collected data, remove duplicate, redundant or invalid information, and organize the data into a unified format and structure to facilitate subsequent processing and analysis;

[0091] Knowledge extraction and structuring: extract the required security knowledge from the cleaned data, structure the required security knowledge, and use knowledge graph technology to build a structured security knowledge base;

[0092] Knowledge verification and review: verify the extracted and structured security knowledge to verify its accuracy and completeness;

[0093] When the accuracy and completeness are verified to be normal, knowledge storage and management are performed, and the verified security knowledge is stored in the knowledge base;

[0094] Establishing a security knowledge base is an important part of the network security monitoring process. The security knowledge base integrates various security vulnerability information, attack methods and defense strategies, and uses AI technology for knowledge management and intelligent retrieval. The security knowledge base can provide security analysts with timely and accurate reference information to help them better understand security incidents and take corresponding countermeasures;

[0095] The visualization module is used to visualize network security information and send it to the preset terminal for display. It uses AI technology to visualize and analyze security data and present complex security information in the form of intuitive charts. This helps network administrators understand the security status of the network more intuitively and quickly discover potential security issues.

[0096] The penetration test module is used to perform simulated penetration tests. After obtaining the penetration test results, they are sent to the preset receiving terminal. The specific process of performing simulated penetration tests is as follows:

[0097] First, AI model training is performed using historical penetration test data, known security vulnerabilities, and hacker attack patterns in historical network security information to train the AI ​​model.

[0098] Automated attack simulation: AI models simulate hacker attack behaviors, conduct automated penetration tests on the network undergoing security monitoring, and obtain penetration test data;

[0099] Result analysis and reporting: Analyze the penetration test data, identify security vulnerabilities and potential problems in the system, and generate a test report to send to the preset receiving terminal.

[0100] The penetration test module conducts simulated penetration testing under the following conditions: first collect the number of real-time network access users, and when the number of real-time network access users is less than the preset value, the simulation test is allowed;

[0101] Analyze and evaluate the simulated penetration test to assess whether the tools and methods used in the simulated penetration test will cause irreversible damage to the target system. If the tools and methods used will not cause irreversible damage to the target system, the simulated test will be allowed.

[0102] The second subsystem is used to monitor and analyze the security of network hardware equipment;

[0103] The second subsystem includes hardware information collection, protection level setting module, protection measures implementation module and data sending module;

[0104] Hardware information collection The collection module is used to obtain relevant information of network hardware devices;

[0105] The protection level setting module is used by users to set the protection level of hardware devices according to their needs;

[0106] The protection measures implementation module is used to select and implement protection measures according to the protection level of hardware equipment, collect and analyze protection data after implementation, and obtain abnormal warning information;

[0107] The data sending module is used to send out abnormal warning information after it is generated.

[0108] The specific process of the protection measures implementation module selecting protection measures and implementing them according to the hardware equipment protection level is as follows: extracting the collected hardware equipment protection level, which includes level 1 protection, level 2 protection and level 3 protection;

[0109] When the hardware equipment protection level is level one, the protection measures corresponding to level one are selected for implementation;

[0110] When the hardware equipment protection level is level 2, the protection measures corresponding to level 2 protection are selected for implementation;

[0111] When the hardware equipment protection level is level 3, the protection measures corresponding to level 3 protection are selected for implementation;

[0112] The protective measures that may be used include physical security measures: placing hardware equipment in a secure physical environment, such as a locked computer room or cabinet, to prevent unauthorized access and physical damage.

[0113] Install security cameras and alarm systems to monitor and record any potential intrusions.

[0114] Access control: Physical access rights to hardware devices are strictly controlled, and only authorized personnel can enter the computer room or cabinet.

[0115] Enable device login control to require users to enter the correct username and password to access the device.

[0116] Adopt multi-factor authentication mechanisms, such as fingerprint and facial recognition, to increase access security.

[0117] Hardware encryption: Use hardware encryption technology to encrypt sensitive data stored in hardware devices to prevent data from being illegally obtained.

[0118] Ensure secure storage and management of encryption keys to prevent key leakage.

[0119] Device updates and maintenance: Keep hardware device drivers, firmware, and operating systems updated to fix known security vulnerabilities and bugs.

[0120] Regularly perform maintenance on hardware equipment, such as cleaning, inspection, and replacement of parts, to ensure the normal operation and safety of the equipment.

[0121] Security monitoring and log auditing: Install a security monitoring system to monitor the operating status of hardware devices, network traffic, etc. in real time to detect potential security threats in a timely manner.

[0122] Establish a complete log audit mechanism to monitor and analyze the operation logs of hardware devices in real time to promptly detect abnormal behaviors and potential security risks.

[0123] Limit external interfaces: Disable unnecessary external interfaces, such as USB ports and serial ports, to reduce potential attack surfaces.

[0124] If you need to use the external interface, you should configure the corresponding access control policy to restrict access to only authorized devices.

[0125] Power supply and heat dissipation: Ensure that the hardware equipment has a stable power supply and be equipped with UPS to cope with sudden power outages.

[0126] Regularly check the cooling system of hardware devices to ensure that the equipment does not overheat during normal operation;

[0127] Regularly check the ambient humidity of hardware equipment to ensure that the equipment will not be affected by moisture during normal operation;

[0128] The protection measures corresponding to the first-level protection include the first-density hardware device monitoring equipment, the first-density temperature sensor, the first-density humidity sensor and the first hardware encryption measures;

[0129] The protection measures corresponding to the second level protection include second density hardware equipment monitoring equipment, second density temperature sensors, second density humidity sensors and second hardware encryption measures;

[0130] The protection measures corresponding to the third level of protection include third-density hardware equipment monitoring equipment, third-density temperature sensors, third-density humidity sensors and third-density hardware encryption measures;

[0131] Different types of protection measures also meet the different protection needs of users, avoiding the situation where protection resources are insufficient at high protection levels and protection resources are wasted at low protection levels.

[0132] Optimized resource utilization: Different network areas or applications may face different levels of security threats. By adjusting the installation density of security protection equipment according to the security level, more security resources can be deployed in high-risk areas, while appropriately reduced in low-risk areas. This helps to achieve optimal resource allocation and avoid resource waste.

[0133] Enhance targeted defense: Adjusting the installation density of security protection equipment for areas or applications with different security levels can strengthen targeted defense measures. In high-risk areas, increasing the number of security devices can improve the ability to identify and respond to potential threats, thereby more effectively protecting important data and systems.

[0134] Improve defense efficiency: A reasonable installation density of security protection equipment can ensure that when a network security incident occurs, the security equipment can respond quickly and take effective defense measures. This helps reduce the impact of network security incidents on enterprises or organizations and improve defense efficiency.

[0135] Flexible response to security threats: Cybersecurity threats are constantly changing, and adjusting the installation density of security protection equipment according to the security level can make organizations more flexible in responding to these changes. When new security threats or attack patterns are discovered, organizations can quickly adjust the device deployment density to strengthen defense.

[0136] Reduce maintenance costs: In areas or applications that do not require an excessively high level of security, reducing the number of safety protection devices can reduce maintenance costs. This includes the cost of purchasing, installing, configuring and maintaining the equipment.

[0137] The above process can enhance security: high-level hardware encryption usually adopts more advanced encryption algorithms and stricter security measures to provide higher levels of security protection. This practice of using different encryption methods for different levels of protection requirements can ensure that sensitive data and key systems can be properly protected at different risk levels.

[0138] Optimize performance: Different types of hardware encryption devices have different performance and efficiency. For scenarios that require processing large amounts of data or high real-time requirements, using high-performance hardware encryption devices can ensure efficient execution of encryption and decryption operations without affecting the normal operation of the business.

[0139] Flexibility: Using different types of hardware encryption can be flexibly configured according to actual needs. Different application scenarios may require different encryption methods or security policies. By using different types of hardware encryption devices, you can choose and adjust according to actual conditions to meet diverse security needs.

[0140] The relationship between the first density, the second density and the third density is: first density> second density> third density;

[0141] The difference between the first hardware encryption measure, the second hardware encryption measure and the third hardware encryption measure is that;

[0142] The first hardware encryption measure uses random three of DES, AES, RSA, and ECC for repeated encryption;

[0143] The second hardware encryption measure uses random two of DES, AES, RSA, and ECC for repeated encryption;

[0144] The third hardware encryption measure uses a random one of DES, AES, RSA, and ECC for repeated encryption.

[0145] The specific judgment process of obtaining abnormal warning information by collecting and analyzing protection data is as follows: extract the real-time protection data collected at the corresponding protection level, and then extract the standard protection data of the corresponding protection level from the preset database. When the deviation between the real-time protection data and the standard protection data is greater than the preset value, abnormal warning information is generated;

[0146] The above process also includes the case where the key used in real time does not meet the labeling usage requirements. When the key used in real time does not meet the labeling usage requirements, an abnormal warning message is generated.

[0147] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0148] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0149] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. An AI-based network security monitoring system, characterized in that: comprising a first subsystem and a second subsystem; The first subsystem is used to monitor and analyze network security itself; The second subsystem is used to monitor and analyze the security of network hardware equipment; The first subsystem network environment acquisition module, anomaly detection module, threat identification module, automated response module and trend analysis and prediction module; The network environment collection module is used to collect network environment information, and the anomaly detection module is used to analyze the network environment information through an AI algorithm to analyze network status information, where the network status information includes network normality and network anomaly; The threat identification module is used to further analyze the cause of the abnormality and determine whether there is a potential network threat when the network status information indicates that the network is abnormal; The automated response module is used to perform an automated protection response to a corresponding threat when the threat identification module identifies a network threat; The trend analysis and prediction module is used to collect historical data and current threat content of network security monitoring, and analyze historical data and current threats to predict possible threats in the future; The second subsystem includes a hardware information collection, a protection level setting module, a protection measure implementation module and a data sending module; Hardware information collection The collection module is used to obtain relevant information of network hardware devices; The protection level setting module is used for users to set the hardware device protection level according to their needs; The protection measure implementation module is used to select and implement protection measures according to the protection level of the hardware equipment, collect and analyze protection data after implementation, and obtain abnormal warning information; The data sending module is used to send out the abnormal warning information after it is generated.

2. The AI-based network security monitoring system according to claim 1, characterized in that: The network environment collection module collects network environment information including network traffic, user behavior, and system logs; The anomaly detection module analyzes the network environment information through the AI ​​algorithm, and the specific process of analyzing the network status information is as follows: Data preprocessing: preprocessing network environment information. The preprocessing includes cleaning data, removing noise, errors and duplicates, and standardizing or normalizing it to obtain preprocessed data. Feature extraction: extracting the required features, the content of which is related to the abnormal behavior; Model selection and training: select AI algorithms to train anomaly detection models. The selected AI algorithms include clustering algorithms, anomaly detection algorithms, and classification algorithms. Use historical data to train the model. The historical data includes samples of normal and abnormal network environments. The first model, the second model and the third model are trained respectively using a clustering algorithm, anomaly detection algorithm and classification algorithm; Input the preprocessed real-time network environment information into the trained first model, second model and third model to obtain the first model result, second model result and third model result; When the first model result, the second model result and the third model result are all network environment abnormalities, it is determined that the network environment is abnormal; When two of the first model results, the second model results, and the third model results are normal and one is abnormal, the model training is performed again; The data anomaly in the first model result, the second model result and the third model result is determined as follows: if the difference between the input data and the normal pattern in the model exceeds a preset range, the model will mark it as an anomaly.

3. The AI-based network security monitoring system according to claim 1, characterized in that: The threat identification module further analyzes these network environment anomalies to determine whether there are potential network threats, uses big data analysis and machine learning technology to identify malicious behaviors in the network, and issues early warnings for possible threats.

4. The AI-based network security monitoring system according to claim 1, characterized in that: The first subsystem also includes a security library establishment module, a visualization module and a penetration testing module; The security library establishment module is used to collect network historical data and establish a security library based on the network historical data; The visualization module is used to visualize the network security information and send it to a preset terminal for display; The penetration test module is used to perform a simulated penetration test and send the penetration test results to a preset receiving terminal after obtaining them.

5. The AI-based network security monitoring system according to claim 4, characterized in that: The specific process of the security library establishment module establishing the security library is as follows: First, conduct a needs analysis to clarify the goals and uses of the security knowledge base and analyze the types of information that need to be included in the knowledge base; Data collection: Collect data related to network security from network historical data; Data cleaning and organization: Clean the collected data, remove duplicate, redundant or invalid information, and organize the data into a unified format and structure to facilitate subsequent processing and analysis; Knowledge extraction and structuring: extract the required security knowledge from the cleaned data, structure the required security knowledge, and use knowledge graph technology to build a structured security knowledge base; Knowledge verification and review: verify the extracted and structured security knowledge to verify its accuracy and completeness; When there are no abnormalities in the verification accuracy and completeness, knowledge storage and management are carried out, and the verified security knowledge is stored in the knowledge base.

6. The AI-based network security monitoring system according to claim 4, characterized in that: The specific process of the penetration test module for performing simulated penetration testing is as follows: First, AI model training is performed using historical penetration test data, known security vulnerabilities, and hacker attack patterns in historical network security information to train the AI ​​model. Automated attack simulation: AI models simulate hacker attack behaviors, conduct automated penetration tests on the network undergoing security monitoring, and obtain penetration test data; Result analysis and reporting: Analyze the penetration test data, identify security vulnerabilities and potential problems in the system, and generate a test report to send to the preset receiving terminal.

7. The AI-based network security monitoring system according to claim 6, characterized in that: The penetration test module performs a simulated penetration test under the following conditions: first collect the number of real-time network access users, and when the number of real-time network access users is less than a preset value, allow the simulation test; Analyze and evaluate the simulated penetration test to assess whether the tools and methods used in the simulated penetration test will cause irreversible damage to the target system. If the tools and methods used will not cause irreversible damage to the target system, the simulated test will be allowed.

8. The AI-based network security monitoring system according to claim 1, characterized in that: The specific process of the protection measure implementation module selecting and implementing protection measures according to the hardware device protection level is as follows: extracting the collected hardware device protection level, which includes level one protection, level two protection and level three protection; When the hardware equipment protection level is level one, the protection measures corresponding to level one are selected for implementation; When the hardware equipment protection level is level 2, the protection measures corresponding to level 2 protection are selected for implementation; When the hardware equipment protection level is level 3, the protection measures corresponding to level 3 protection are selected for implementation; The protection measures corresponding to the first-level protection include a first-density hardware device monitoring device, a first-density temperature sensor, a first-density humidity sensor and a first hardware encryption measure; The protection measures corresponding to the second-level protection include a second-density hardware device monitoring device, a second-density temperature sensor, a second-density humidity sensor and a second hardware encryption measure; The protection measures corresponding to the third level of protection include third density hardware device monitoring equipment, third density temperature sensors, third density humidity sensors and third hardware encryption measures.

9. The AI-based network security monitoring system according to claim 8, characterized in that: The magnitude relationship among the first density, the second density and the third density is: first density>second density>third density; The difference between the first hardware encryption measure, the second hardware encryption measure and the third hardware encryption measure is that; The first hardware encryption measure uses random three of DES, AES, RSA, and ECC for repeated encryption; The second hardware encryption measure uses random two of DES, AES, RSA, and ECC for repeated encryption; The third hardware encryption measure uses a random one of DES, AES, RSA, and ECC for repeated encryption.

10. The AI-based network security monitoring system according to claim 8, characterized in that: The specific judgment process of collecting and analyzing protection data to obtain abnormal warning information is as follows: extract the real-time protection data collected at the corresponding protection level, and then extract the standard protection data of the corresponding protection level from the preset database. When the deviation between the real-time protection data and the standard protection data is greater than the preset value, abnormal warning information is generated.

Images